Audit Active Dovecot Sessions with doveadm who

You will finish with a repeatable way to see which Dovecot users are connected, which service they are using, and which client addresses they came from. You will also be able to narrow the result by username or network without disconnecting anyone.

Allow about ten minutes. You need shell access to a Dovecot host, the dovecot-core package, and permission to access Dovecot's administration socket. The examples here match the installed Dovecot v2.3 manpage and package version 1:2.3.21+dfsg1-2ubuntu6.5. Your live session list will, of course, be different.

1. Check the installed command

Start with read-only checks. These do not need elevated privileges:

$ command -v doveadm
/usr/bin/doveadm
$ dpkg-query -W -f='${Package} ${Version}\n' dovecot-core
dovecot-core 1:2.3.21+dfsg1-2ubuntu6.5
$ doveadm help who

The command's synopsis is doveadm who [-1] [-a SOCKET] [USER] [IP[/MASK]]. Its default output formatter is table. The command reports current connections, grouped by username unless you ask for one line per user and connection.

2. Run the basic session report

Run the command with no filters. This is an inspection operation, but it reads the Dovecot administration socket, so a normal login may not be allowed to use it:

$ sudo doveadm who
username                       # proto (pids)        (ips)
jane                           2 imap  (30155 30412) (::1)
[email protected]               1 imap  (30257)       (192.0.2.34)

The example values are illustrative. The first column is the username. The protocol and process IDs appear in the middle, and the client addresses appear at the end. Several connections for one user can be grouped onto one row.

If you omit sudo and see Permission denied for /run/dovecot/anvil, the command has not produced a session report. Retry as an account authorised to use the socket, or ask the Dovecot administrator which account and socket policy are intended. Do not weaken socket permissions just to make a diagnostic command work.

3. Filter by client address

Pass an IPv6 address, IPv4 address, or CIDR network as the final argument. The filter reduces the result to matching connections:

$ sudo doveadm who 192.0.2.0/24
username                        # proto (pids)  (ips)
[email protected]                1 imap  (30257) (192.0.2.34)

$ sudo doveadm who ::1
username                       # proto (pids)        (ips)
jane                           2 imap  (30155 30412) (::1)

Use a mask when you mean a network, not one host. IPv4 and IPv6 addresses are accepted in the same position. An empty result is a valid result: it means no current connection matched the address filter, not necessarily that Dovecot is down.

4. Filter by username

Put a username or username pattern in the argument position before the optional IP filter:

$ sudo doveadm who 'ja*'
username                    # proto (pids)        (ips)
james                       1 imap  (30091)       (127.0.0.1)
jane                        2 imap  (30155 30412) (::1)

$ sudo doveadm who '[email protected]' 192.0.2.0/24
username                    # proto (pids)  (ips)
[email protected]            1 imap  (30257) (192.0.2.34)

The manpage permits wildcards in the username. Quote a pattern so the shell does not expand it against files in your current directory. That small quoting detail is a common distraction when a wildcard appears to return no users.

Keep the argument order clear: username first, address second. If you need to inspect every user from one network, pass only the network. If you need one user from one network, pass both.

5. Choose a less ambiguous output format

Use the global -f option before who when another program or a careful review needs a different layout:

$ sudo doveadm -f flow who '[email protected]'
[email protected] proto=imap pids=30257 ips=192.0.2.34

$ sudo doveadm -f tab who
username\t# proto (pids)\t(ips)
jane\t2 imap (30155 30412)\t(::1)

The installed v2.3 manpage documents four formatters. table adjusts columns for people, tab uses tab-separated values, flow prints key and value pairs, and pager puts each key and value on its own line with a form-feed between records. Choose flow or tab when column spacing would make downstream parsing fragile.

6. Show one line for every connection

By default, connections are grouped by username. Add -1 when you need each user and connection on its own line:

$ sudo doveadm who -1 'jane'
username  proto  pid    ip
jane      imap   30155  ::1
jane      imap   30412  ::1

The exact spacing and fields depend on the selected formatter and the running Dovecot instance. Treat the header as authoritative. The point of -1 is to stop multiple connections being collapsed into one grouped record.

7. Investigate socket and configuration mismatches

The default local socket is /run/dovecot/anvil. If the host uses a different base_dir, the socket can be elsewhere. Ask the administrator to confirm the effective configuration rather than guessing a path:

$ sudo doveconf -n | grep '^base_dir'
base_dir = /run/dovecot/
$ sudo doveadm who -a /run/dovecot/anvil

-a also accepts HOSTNAME:PORT for a remote TCP socket. That is security-sensitive: it exposes an administration operation over a network path and must match the Dovecot deployment's authentication and firewall design. Do not point it at an untrusted host, publish the socket, or change firewall rules as part of this check.

This guide changes no persistent configuration and disconnects no sessions, so there is nothing to undo. If a socket path or access policy was changed separately to diagnose the issue, restore its previous value and verify the service before declaring the investigation complete.